PCNSE SSL/TLS Decryption and Inspection

Question 1

Which decryption mode does Palo Alto Networks use to inspect outbound user-initiated HTTPS traffic to the internet?

Accepted Answer

SSL Forward Proxy

Answer

SSL Forward Proxy is used for outbound traffic where the firewall acts as a man-in-the-middle, re-signing server certificates with its own CA certificate.

Question 2

Which certificate must be distributed to client machines to prevent SSL warnings when SSL Forward Proxy decryption is enabled?

Accepted Answer

The firewall's Forward Trust CA certificate

Answer

The Forward Trust CA certificate must be installed as a trusted root CA on client devices so that firewall-re-signed certificates are trusted without browser warnings.

Question 3

What is the purpose of the 'Forward Untrust' certificate in SSL Forward Proxy decryption?

Accepted Answer

To re-sign certificates from untrusted CAs so clients receive a warning

Answer

The Forward Untrust certificate re-signs server certificates that have untrusted, expired, or invalid CAs, intentionally triggering a browser warning to alert the user.

Question 4

Which decryption type requires uploading the web server's private key to the firewall for inspecting inbound HTTPS traffic?

Accepted Answer

SSL Inbound Inspection

Answer

SSL Inbound Inspection uses the server's private key to decrypt inbound HTTPS sessions so the firewall can inspect traffic destined for internal servers.

Question 5

In a decryption policy, which action explicitly exempts matched traffic from SSL/TLS inspection?

Accepted Answer

no-decrypt

Answer

The 'no-decrypt' action in a decryption policy rule prevents the matched traffic from being decrypted, passing it through without SSL inspection.

PCNSE Exam Practice Test

PCNSE Exam Practice Test

PCNSE SSL/TLS Decryption and Inspection